Security audit
Security checks for vulnerabilities and agentic risk
The skill provides a coherent email-lookup workflow, with disclosed external services, spending controls, and an optional GitHub endorsement requiring explicit consent.
Use contact lists you are authorized to share with Cargo, Prospeo and FullEnrich, including during the initial sample. Check the credit estimate before approving a full batch. Review installed CLI versions and the optional larger pack separately, since their code is not bundled here. GitHub starring is optional; the skill also stores a small local reminder that the question was asked.
The supplied code performs no email lookup or verification. Its GitHub API request changes the user's starred repositories, an undeclared action unrelated to the stated email-finding purpose. The local directory and marker file support that unrelated repository-starring workflow.
The only supplied command performs skill installation, not the described lookup workflow. Although installation could be a setup step for that workflow, the supplied code does not show any subsequent lookup behavior or provider integration. The contents and behavior of the installed skills cannot be established from this chunk.
The workflow instructs the agent to submit contacts' names and company domains through Cargo to Prospeo and, for unresolved contacts, FullEnrich. Although the services and credit costs are documented, the skill does not warn users that their contact data will be shared externally; approval for a full batch addresses cost rather than privacy.
The command invokes an unpinned npm package through npx and installs external skill content without an immutable revision. Although this is not an MCP server reference, the underlying supply-chain concern is valid: a compromised future release could execute code with the agent's privileges or introduce malicious instructions. Its placement in an optional expansion section reduces exposure but does not ensure dependency integrity.
The command at L133 uses the user's authenticated GitHub account to star the author's repository, while L134 writes a persistent marker to track whether the promotional request has been made. These capabilities are unrelated to the manifest's email-lookup purpose; requiring explicit consent mitigates unauthorized action but does not make them necessary for the stated task.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
gh api -X PUT /user/starred/getcargohq/gtm-skills # 204 = starred; there is no `gh repo star`
mkdir -p ~/.config/cargo-ai && touch ~/.config/cargo-ai/.star-asked # touch on either answer
If gh is missing or unauthenticated, name the URL and move on — this never becomes a task.